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(g) Data analysis and event prediction in a telecommunications network. 

(§7) A facility is provided for enhancing an oper^ 
ations support system so that, based on data 
generated as a result of an event occurring in an 
associated telecommunications network, the 
operations support system can predict the 
likelihood of the event occurring again in the 
network. 
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A.argetelecornmun^^ 
time. e.g.. twenty-four hours. Such reports include ^^^^SZ^JLm network aocu- 
alarms. etc. A Network Management System (NMS) "^J^^J^ network . Such management in- 
mulates and processes the data to track and manage J^^^^ h ^hphon. ti^ ^ 
eludes (a) identifying and repairing '<^ B ^^^^^^M ma be classified as 
terns. For example, consider the way .nwh^^^^^ 
eittef transient or non-transient. Non-tran»^^ 

on the other hand, are usually indicative of e.ther a n0 ^"2^6 ^"^y be ignored. The reason 
-occurring alarm is u^^^ 

tions when it occurs. ^ distinguish a chronic alarm from a transient, non-chronic alarm. 

Summary of the Invention 

so that, in accord with an aspect of the invent™, .t O 6 ^^"^^,^ by he telecommu- 
telecommunications system and then applies the ^ •^^Jj^'K. iilusJtive embodiment 
nicationssystemtop^^^ 

by the data. The rule set is then used to predict future occurrences of the events. 
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In the FIGs: 



45 



50 



55 



1. 

Detailed Description 

Turning now to F.G.1 there is shown a broad block dia gra= ^ 
ZOOandoperationssupportsystem 300. Operations sup^ 

all operation of network 200. One aspect of such support^ ^SSSSmte comprising network 200. 
by accumulating and processing ^J^^S^^^iX^ Editions. Such 
An a.arm message^ be rn^'^^^.^t^a-. (b) a chronic probiem that 
conditions include (a) a spunous problem ^ "JJ^S^Suw to slowly degrade over time, (c) a "hard' failure 
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ticular problem and the identity of the network 200 facilities that might be affected by the problem. 

The alarm messages that are stored in database 30 may be acc ssed by facility type. For example, all 
alarm messages associated with a particular type of facility, such as echo cancelers. may be accessed by pre- 
senting a request identifying the particular type of facility type to database 30. Such access may be refined 

5 by also specifying a particular period of time in the request In response to the request, database 30 outputs 
an alarm message that occurred over the specified period of time for the identified type of facility. 

One dilemma that an operations support system faces is which of the large number of alarms that are gen- 
erated on a daily basis should be addressed first. It is apparent that alarms that are generated as a result of 
a "hard" fault are usually easy to identify and are addressed first. However, the majority of alarms that are 

10 generated daily are typically due to spurious conditions and chronic problems. Moreover, it is difficult to de- 
termine initially whether an alarm occurred as a result of a spurious condition or a chronic problem. As such, 
much effort is sometimes directed to tracking down the cause of spurious alarms since they comprise the ma- 
jority of alarms that occur each day. Accordingly, alarms identifying a chronic problem may not be dealt with 
until the facility generating such alarms degrades to a hard fault 

15 Recognizing that problem, we have adapted an operations support system so that it processes alarms to 

identify chronic problems and prioritize the repair of those problems. To that end. Operations Support System 
(OSS) 300 includes rule generator 40 and operations system processor 50 which operate in accordance with 
the invention to identify and prioritize chronic problems. More particularly, rule generator 40, which may be, 
for example, embodied in a SPARC station 2 available from Sun Microsystems, Inc., responds to receipt of a 

20 command from an external source, e.g.. terminal T2. by sending an access request identifying a facility type 
and period of time to database 30. As mentioned above, database 30. in response to such a request, outputs 
all alarm messages that occurred over the specified period of time for the type of facility identified In the re- 
quest, in which the facility type may be. for example, echo cancelers. T1 carriers. T3 carriers, toll switches, 
etc. The specified period of time is typically one to several weeks and may be identified by a starting date and 

25 an ending date. . . 

Assuming that the requested period of time equals two weeks and the facility type is T1 earners, then the 
number of alarm messages of the requested type that database 30 outputs could be very large if network 200 
employs an appreciable number of T1 carriers. Upon receipt of the alarm messages, generator 40 stores them 
in its associated memory 41 such that alarm messages associated with a specific facility are stored in a re- 

30 spective memory array. When all such messages have been received from database 30 and stored in memory 
41 then generator 40 processes the messages and generates, in accord with an aspect of the invention, a set 
of rules which may be applied to identify which of the alarms stored in memory 41 are indicative of respective 
chronic problems. The rules are then passed to operations system processor 50, which then applies the rules 
to alarm messages associated with the same type of facility, but occurring thereafter. Such rules are also 

35 passed to processor 60, as discussed below. 

The program which controls the operation of processor 40 to generate a particular set of rules for the proc- 
essing of alarm messages is shown in flow chart form in FIG. 2. Specifically, the program is entered at block 
2000 responsive to receipt of the aforementioned command. At block 2000, the program proceeds to block 2001 
where it forms a request message containing the identity of the facility type and particular period of time, as 

40 discussed above. The program then supplies the message to database 30. As mentioned above, database 30, 
in turn, (a) unloads the alarm messages from its associated memory for the specified facility type and for the 
cnar-if i»d period of time and (b) passes them to processor 40. Processor 40. in turn and under control of the 
program, stores the messages in associated memory 41, as mentioned above. When such alarm messages 
have been so stored, the program then proceeds to block 2002. (Hereinafter the term "alarm' may also be re- 

45 ferred to as an event.) 

At block 2002. the program processes the stored messages to obtain a number of different performance 
measurements for each facility of the specified type. The measurements summarize spatial and temporal in- 
formation about a facility and associated problems. Such measurements may include the number of (a) dif- 
ferent types of alarm messages that occurred for the specif ic facility, (b) times an alarm (event) occurred during 

so a unit of time for the facility, (c) units of time or (d) the location of the facility, during which the alarm (event) 
occurred As will be discussed below, such measurements are determined for first and second windows. W1 
and W2. comprising the aforementioned specified period of time. In addition, each window is partitioned into 
units of time for the purpose of performing such measurements. (An illustrative list of such performance meas- 
urements, or features, is shown in Appendix A.) 

55 Specifically, blocks 2002. 2003 and 2004 constitute a "do" loop for processing alarms associated with the 

identified facility. Once it identifies such messages, then the program generates the different performance 
measurements for each window. W1 and W2. and for the units of time associated with those windows. In ad- 
dition the program accesses database 20 to determine the circuit layout for the facility within network 200. 
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The circuit layout indudes the identities of the other network 200 elements « ^^Jf^ 
the facility. The program then performs the same process.ng steps for a nextfac.l.ty 1 ™ 

program exits the do loop and proceeds to block 2005 upon processing the a.arm messages for all of th fa 

foreSrS 

XSdaSe also indudes a header which ^^^^^^^^^ 
L/of the fields The program proceeds to block 2006 once it has completed the building of the date f Me At 
b k 2006 Co^m emers a rule generation program, which processes the data file using 
methods to generate a set of rules for the specified type of facility. For example, a set of rules rt -«m ,*m f 
aS > B Sen ^0^ Cass 1», where A may represent a performance measurement, B may represent a par- 

dJ^^SS "Reduced Comply Rule Induction^ S J^N^J^ £ 
lished in the Proceedings of the International Joint Conference on Artificial Intellqence flJCgfl, .Sydney Aus 
tralia 991 plg^sl^^i^sl^incorporated by reference. Alternatively a "™ber crf«* induo- 
tLTprogis are commercially avai.ab.e, such as the C4.5 program available from Morgan Kaufmann Pub- 

various classes of data e.g. alarm messages respectively relating to spurious and chronic problems. Acovenng 
ISS heuristically searching for a single best rule that covers different cases , e.g , racords 
Tthe data fHe for only one class. Once a best conjunctive rule is found for a part.cular class e.g. chronic o 

of th^daSe Tnerated i block 2005. In doing so, it prunes the rule sets so that an error rate def.n.ng the 

may be minimized when applied to the test data. That is. the program 
pnTthe ?of a rule set to predict the occurrence of chronic as well as nonchronic alarms. Fo.low.ng 

^ S^-^T^l^- - °< -.es generated at block 2006 in which the 
selellTb sTd o at P elation provided by an externa, source, for example, a user 
; SSh^Scatton may request a rule set having a particular predictive accuracy for a certain 

Coverage as defined herein is a measure of the range of part.cular problems, e.g., chronic problems, 
rule set can predict accurately. For example, the following illustrates one possible rule set 

ALRD > x, 
40 FBL>x 2 

SLL>x 3 

OFL>X4 0r 

where M*ough x* are particu.ar va.ues that are generated by the rule generato^The coverage of the above 
45 rule set may be increased by adding, for example, the following rule to form a rule set of 2. 
CT2 & ALRCT > Xe & ALRH > x 7 ; 

^is^ 

•JJi^T ~ The reason for this is that as the number of cases that are covered .ncreases ft . 

it thin ™-oLds to block 2008 where it outputs the rule set to processor 50 and processor 60. The program 
hen^^ 

erate a rule set for another type of facility. If that is the case, then the program proceeds to block 2010 where 
55 ftobla!^ Men Sr the specified facility and then returns to block 2001. Otherwise, the program exits 
55 ,t obtam stfc Mdent y fo P ^ ^ ^^.^ ^ ^ ^ ^ ^ message that it 

obta"sro~ 

ic problem and output a message to that effect via path 51 . In this way, processor 50 may direct attention away 
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from spurious problems (nonchronic problems) and focus attention on chronic problems so that such problems 
may be dealt with before they degrade into a hard fault. 

The rule set outputted by processor 40 may also be used to predict trends in the occurrence of chronic 
problems. Quality control processor 60 uses the rule set to determine such trends, and uses the trends in con- 
junction with other quality control criteria, e.g., the rate at which chronic problems are being repaired, to eval- 
uate the performance of network 200. For example, if a trend indicates that a particular section of network 
200 may exceed its number of allowable chronic problems for given peiriod of time, then processor 60 uses 
that trend to output a performance value for that section of network 200. 

As mentioned above, rule induction can be applied to other applications as a way of generating rule sets 
for those applications. For example, one application may be traffic data in which rule induction may be applied 
to such data to generate a set of rules that may be used to predict particular trends in future traffic patterns. 
In particular, traffic data may be collected over period of time and stored in a database, e.g., database 30. The 
above-described program at block 2001 (FIG. 2) may then access that data as well as data indicative of the 
topology of the network in the manner discussed above. The program may then divide the traffic data into re- 
spective windows W1 and W2, and then generate a rule set for the data. The measurements made in W1 are 
used to predict the measurements in W2. If the prediction is accurate, then the rule set may be used to predict 
future traffic patterns, in which such patterns may be, for example, predicting appropriate levels of blocking 
for particular telephone routes. 

As another example, when a disaster strikes a particular area, e.g., a hurricane, particular controls are 
activated to automatically block low priority calls so that such calls do not impact the processing and routing 
of high priority calls. The levels of such controls can be predicted accurately by processing traffic data accu- 
mulated during a previous disaster, in accord with the invention, to generate a rule set that can be used to predict 
such levels of control. 

The foregoing is merely illustrative of the principles of the invention. Those skilled in the art will be able 
to devise numerous arrangements, which, although not explicitly shown or described herein, nevertheless em- 
body those principles that are within the spirit and scope of the invention. 



APPENDIX A 

Some examples of Performance Measurements for facilities with failures: 



Measurement Name Description 

ALRD Number of time units with alarms 

ALRH Number of rime units with alarms during the last day 

ERHD Number of time units with exceptions over a threshold H 

ERLD Number of time units with exceptions over a threshold L 

OFH Number of time units with out-of-frame exceptions over a threshold H 

OFL Number of time units with out-of-frame exceptions over a threshold L 

FBL Number of time units with framing bit exceptions over a threshold L 

BVL , Number of time units with Bi-polar violations over a threshold L 

SLL Number of time units with slips over a threshold L 

ALRCT Total number of alarms 

AVGAL Average number of alarms per time unit with alarm 

OST Seconds facility was out of service 

CT1 Type of circuit - Domestic circuit 

CT2 Type of circuit - International circuit 

CT3 Type of circuit - Private lines. 
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Claims 

may be predicted using said at least one rule set. 

. , ■ ^ ci ibthfr CHARACTERIZED BY the step of applying said at least one 

said events. 

.• « ci irthfr CHARACTERIZED IN THAT said step of generating includes 

pluralityof rule sets which meets a predetermined specification. 

, ■ . - m o ci IRTHER CHARACTERIZED IN THAT said predetermined specification 

■ • , ci irthfr CHARACTERIZED IN THAT said step of generating includes 
5 The method set forth in claim 3 FURTHER CHAKAo i tni^-cu 

■-I idtucd characterized IN THAT said particular data defines re- 

. ■ , i ci irthfr CHARACTERIZED IN THAT said particular data defines d.f- 
7 The method set forth in claim 1 FURTHER CHAKAv I tr^c 
' ferent traffic patterns within said telecommunications system. 

u - ■ • 4 c. irthfr CHARACTERIZED IN THAT said step of generating includes 
3S 8 The method set forth in claim 1 FURTHER CHAKAO i tiM^c 

^^Clyingsaidatleastonerulesettoaqualitycontrolpro^ 
essor may predict trends in the occurrence of said events. 

• ■ ■ « c. irthfr CHARACTERIZED IN THAT said particular data is service 

system. 
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